oss-security - Local privileges escalation in rubygem open-uri-cached

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150505172741.GE17491@sisay.ephaone.org>
Date: Tue, 5 May 2015 19:27:42 +0200
From: Michael Scherer <misc@...b.org>
To: cve-assign@...re.org
Cc: oss-security@...ts.openwall.com
Subject: Local privileges escalation in rubygem open-uri-cached 

Hi,

open-uri-cached, a rubygem that will cache downloaded data when using open-uri, is 
suceptible to a local attack due to usage of YAML in a insecure way, and using
a predictable directory name in /tmp for getting that data without verification, see
https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L39
https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L25
and https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L115

So someone could create ahead of time a directory /tmp/openuri-$someuid/, precreate directory
for the host to contact and with proper permissions, wait until a meta file is created, and
replace it with one containing ruby code to be executed, as it doesn't use safe loader for yaml
( http://www.benjaminfleischer.com/2013/03/20/yaml-and-security-in-ruby/ ).

The gem is pulled by various projects on github, the likely most important being
a redmine plugin : https://github.com/backlogs/redmine_backlogs 

Could a CVE be assigned ? I will take care of opening a issue on github  for that
after :
https://github.com/tigris/open-uri-cached

-- 
Michael Scherer

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.